10 ms·
Decrypting your own HTTPS traffic with Wireshark
- throwra620 5y agoThis blog is awful to read. Wireshark will decrypt your ssl traffic automatic if you tell it to.
- Retr0id 5y agoWith which keys?
- collsni 5y agoconfidently incorrect
- Sophira 5y agoHow would one go about doing this? I've never been able to get it to do that.
- noselasd 5y agoWireshark doesn't come with a built in way to extract the dynamically exhanged TLS keys from applications and use that to decrypt the traffic, so no it does not do what you claim.
- linsomniac 5y ago(Sorry folks, was replying to the (at the time) only other comment about wireshark automatically doing decryption - edit) This doesn't work if you use DH, and you should be using DH. To work with DH, you need to run your browser with a SSL key logfile, as discussed here: https://security.stackexchange.com/questions/35639/decrypting-tls-in-wireshark-when-using-dhe-rsa-ciphersuites https://security.stackexchange.com/questions/35639/decryptin...
- Retr0id 5y agoThat's exactly what this article covers.
- kingforaday 5y agoPop Quiz: Who remembers Wireshark’s original name? What a fun tool for over two decades!
- ziml77 5y agoEthereal. But I thought it was pronounced Ether Real. I'm not sure I'd encountered the word ethereal in any other context at that point (pre-teen/young teen).
- bsedlm 5y agoethersomething??
- cookiengineer 5y ago> Pop Quiz: Who remembers Wireshark’s original name? That's a real question for the ethernet people ;)
- pieter_mj 5y agoHehe, I've never used it when it was called ethereal.
- kingforaday 5y agoLove it! :)
- maze-le 5y agoI still remember how flashed I was seeing the byte-by-byte analysis of a network package for the first time -- it was a real eye opening moment for me.
- qiskit 5y agoHate to be that guy, but network packet. But yeah, it's quite the revelation especially when you realize other people can also sniff the network and capture the unencrypted traffic. Remember thinking nobody would waste so much time and energy. How young and naive I was back then.
- ravishi 5y agoHow would one go about doing that for Android apps? I guess android apps don't respect that flag?
- rl1987 5y agoAs long as there's no certificate pinning implemented in the apps (which can be defeated with some effort) I would go with a different approach and use mitmproxy. See: https://www.trickster.dev/post/setting-up-mitmproxy-with-android/ https://www.trickster.dev/post/setting-up-mitmproxy-with-and...
- punnerud 5y agoCan use frida-sslkeylog to extract the keys on Android, and put it into Wireshark: https://github.com/saleemrashid/frida-sslkeylog https://github.com/saleemrashid/frida-sslkeylog This require a rooted phone. Or you can patch the app with objection, so you don’t need the root: https://github.com/sensepost/objection/wiki/Patching-Android-Applications https://github.com/sensepost/objection/wiki/Patching-Android... Can download the APK from places like https://apkpure.com/ https://apkpure.com/
- almog 5y agoapkpure.com has a track record of serving malicious APKs. If you run it in a sandbox environment it's probably okay-ish, but if you already have the app installed from a trusted source on your phone, you can grab the APK file with `adb pull`.
- punnerud 5y agoDid not know that. Thanks
- dylanowen 5y agoYeah I've had good success with patching apps. If the app complains the phone is an emulator, just patch the byte code that is checking for emulators too :)
- candiddevmike 5y agoI was trying to hack/reverse engineer some IoT API calls, and I really wish there was some middle ground between "Don't trust any network, encrypt everything end to end" and "I can MitM anything I want". Everything on my network is a (sometimes literally) black box sending and receiving who knows what. As a network operator, I should be able to MitM everything on my network. But I don't want people to MitM me when I'm on a public network, so I'm at a loss on how to fix this.
- unnouinceput 5y agoOn public network you use tunnels aka end-to-end-encryption. On your private network you control (theoretically) everything.
- teraflop 5y ago"Private" and "public" are relative terms. From the perspective of an IoT smart thermostat talking to its mothership, your home network is a public connection, and it's successfully using E2E encryption to protect its private data from you -- even though you theoretically own it.
- getcrunk 5y agoNice! It's a subtle shift but I think your framing is key.
- dec0dedab0de 5y agoMost b2b gear will play well with a proxy server, and that will allow you to explicitly mitm everything going to the internet. Just don't allow anything else out. One annoying problem is certificate pinning, if you have deices that join your network and others, but it's doable. The real problem is devices sold to consumers that don't allow you to install custom certs or allow you to configure a proxy. There should probably be a law that says every network device should have a means for the owner to decrypt the traffic on the fly.
- 5y ago
- geraldcombs 5y agoAs the blog post points out, this requires coordinating Wireshark's "(Pre-)Master Secret Log filename" / tls.keylog_file preference with you web browser's environment, so a while back I wrote a Wireshark Lua plugin that automates as much of this as possible. It pops up a window that lets you launch Chrome or Firefox with the SSLKEYLOGFILE environment variable set to the correct value: https://gitlab.com/-/snippets/2156054 https://gitlab.com/-/snippets/2156054
- vxNsr 5y agoThank you for this
- pabs3 5y agoI think this would be interesting to have in Wireshark itself, have you considered contributing it back upstream?
- geraldcombs 5y agoI'll see what I can do. :)
- pabs3 5y agoAwesome, thanks!
- rileymat2 5y agoHow does this work with perfect forward secrecy, does curl save all the keys? Or is it disabled?
- racingmars 5y agoFirst step the article gives: `export SSLKEYLOGFILE=~/.sslkeyfile` This will tell curl, among many other applications, to save the necessary keys.
- rileymat2 5y agoYes, I saw this and tried that, but when running curl only saw one key. I just expected more.
- dorianmariefr 5y agoI prefer mitmproxy
- mhils 5y agoYou can have both! mitmproxy will dump TLS master secrets for any app: https://docs.mitmproxy.org/stable/howto-wireshark-tls/ https://docs.mitmproxy.org/stable/howto-wireshark-tls/
- bmm6o 5y agoSomething like mitmproxy can be easier, but the Wireshark approach has the advantage of not changing the wire traffic. That is, some problems could go away when you introduce a proxy.
- ThePhysicist 5y agoNeat, I didn't know about SSLKEYLOGFILE, seems like a great way to debug apps that support it without installing custom root certificates.
- funshed 5y agoI can't figure out how to do virtualized android devices? any tips.
- raro11 5y agoToday I got everything working using BlueStacks. You still have to root the emulated device as you would with a regular device. But it works
- salmaanp 5y agohow would this work for custom applications? Say I have a C program which does openssl handshakes inside. How can we implement the same SSLKEYLOGFILE functionality in it
- bigcat123 5y ago
- 2143 5y agoFor academic purposes (in grad-school as part of my networks class), I have used T-Shark before to monitor packets. (Shameless self-promotion) I had written a blog post about it back then. Here goes [1] [1] https://arjkb.gitlab.io/post/2017-11-27-capture-packets-using-t-shark/ https://arjkb.gitlab.io/post/2017-11-27-capture-packets-usin...